There have been numerous articles about information buried in Word documents about earlier generations of these. I would take a text examining tool and try to examine the document files to see if there were evidence in one of text from the other...an edit trail, in other words. There are sites out there that describe some things about the format Word uses that may help. -----Original Message----- From: Rowe, Eric [mailto:ericat_private] Sent: Friday, September 14, 2001 6:58 PM To: 'forensicsat_private' Subject: RE: Forensics on Word Documents (again) Just another thought... If the Word files were emailed at any point you should also be able to check the server logs and trash for file sizes - or for actual copies of the files. Exchange, Mercury, and a lot of other mail servers allow you to recover these files even after they have been emptied from trash. (I've recovered files and attachments dating back more than a year for some faculty members.) ***************************** Eric R. Rowe - A.C.F.Sc. Computer Systems Coordinator School of Nursing - UBC (604) 822-7439 ***************************** ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com ********************************************************************** This transmission may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you ********************************************************************** ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Mon Sep 17 2001 - 11:06:12 PDT